gigacode-desktop-bin

MEDIUM

maintainer ArteS 0 votes scanned 2026-10-19 11:27:14.276086

View on AUR

Why flagged

Prebuilt binary (Electron app) downloaded from gigacode.ru, a non-standard/non-whitelisted host that is plausibly the project's own official domain but cannot be independently verified; the sha256 checksum is present which mitigates swap risk, but it remains an unverifiable closed-source prebuilt executable from a Russian commercial host with few AUR votes.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://gigacode.ru/plugins/${_archive}")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary (Electron app) downloaded from gigacode.ru, a non-standard/non-whitelisted host that is plausibly the project's own official domain but cannot be independently verified; the sha256 checksum is present which mitigates swap risk, but it remains an unverifiable closed-source prebuilt executable from a Russian commercial host with few AUR votes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Artem Shustrov <shustrov_a at inbox dot ru>
    
      2# Upstream release list: https://gigacode.ru/jarvis/versions
    
      3pkgname=gigacode-desktop-bin
    
      4pkgver=26.10.109
    
      5pkgrel=1
    
      6pkgdesc='GigaCode Desktop AI assistant'
    
      7arch=('x86_64')
    
      8url='https://gitverse.ru/features/gigacode/install/'
    
      9license=('unknown')
    
      10depends=(
    
      11  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc'
    
      12  'gtk3' 'libcups' 'libgcc' 'libstdc++' 'libx11' 'libxcb'
    
      13  'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
    
      14  'libxrandr' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'xdg-utils'
    
      15)
    
      16makedepends=('unzip' 'asar')
    
      17options=('!strip' '!debug')
    
      18_archive="gigacode-desktop-linux-${pkgver}.zip"
    
      19source=("https://gigacode.ru/plugins/${_archive}")
    
      20sha256sums=('e8a9fe520ed1c59ecb58b6ed8cd657e182733b0db7867f91cebdc808a230c6d7')
    
      21noextract=("${_archive}")
    
      22
    
      23package() {
    
      24  local asar_dir size
    
      25
    
      26  install -dm755 "${pkgdir}/opt/gigacode"
    
      27  unzip -q "${srcdir}/${_archive}" -d "${pkgdir}/opt/gigacode"
    
      28
    
      29  chmod 644 \
    
      30    "${pkgdir}/opt/gigacode/resources/configUrl.txt" \
    
      31    "${pkgdir}/opt/gigacode/resources/cli/package/configUrl.txt"
    
      32
    
      33  test -x "${pkgdir}/opt/gigacode/gigacode" || return 1
    
      34
    
      35  # Extract asar resources
    
      36  asar_dir=$(mktemp -d "${srcdir}/gigacode-asar.XXXXXX")
    
      37  PATH="${pkgdir}/opt/gigacode/resources/nodejs/bin:${PATH}" \
    
      38    asar extract "${pkgdir}/opt/gigacode/resources/app.asar" "${asar_dir}"
    
      39
    
      40  # A git subprocess may close stdin before Node finishes writing to it.
    
      41  if grep -Fq 'child.stdin.end(input ?? "");' "${asar_dir}/dist-electron/main.cjs"; then
    
      42    sed -i 's/child\.stdin\.end(input ?? "");/child.stdin.on("error", (error) => { if (error.code !== "EPIPE") resolve8({ ok: false, stdout, stderr, error: error.message }); }); child.stdin.end(input ?? "");/' \
    
      43      "${asar_dir}/dist-electron/main.cjs"
    
      44  fi
    
      45
    
      46  for size in 16 24 32 48 64 96 128 256 512; do
    
      47    install -Dm644 "${asar_dir}/dist/app-icons/icon-${size}.png" \
    
      48      "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/gigacode.png"
    
      49  done
    
      50
    
      51  PATH="${pkgdir}/opt/gigacode/resources/nodejs/bin:${PATH}" \
    
      52    asar pack "${asar_dir}" "${pkgdir}/opt/gigacode/resources/app.asar"
    
      53  rm -rf "${asar_dir}"
    
      54
    
      55  install -dm755 "${pkgdir}/usr/bin"
    
      56  # The upstream registration creates a second desktop entry without an icon.
    
      57  cat > "${pkgdir}/usr/bin/gigacode-desktop" <<'LAUNCHER'
    
      58#!/bin/sh
    
      59GIGACODE_SKIP_PROTOCOL_REGISTRATION=1 exec /opt/gigacode/gigacode "$@"
    
      60LAUNCHER
    
      61  chmod 755 "${pkgdir}/usr/bin/gigacode-desktop"
    
      62  ln -s gigacode-desktop "${pkgdir}/usr/bin/gigacode-deeplink-wrapper.sh"
    
      63
    
      64  install -dm755 "${pkgdir}/usr/share/applications"
    
      65  cat > "${pkgdir}/usr/share/applications/gigacode.desktop" <<'DESKTOP'
    
      66[Desktop Entry]
    
      67Type=Application
    
      68Name=GigaCode Desktop
    
      69Comment=AI assistant for development and office work
    
      70Exec=gigacode-desktop %u
    
      71# KWin resolves the Wayland window icon from this desktop entry.
    
      72Icon=/usr/share/icons/hicolor/512x512/apps/gigacode.png
    
      73Terminal=false
    
      74Categories=Development;
    
      75MimeType=x-scheme-handler/gigacode;
    
      76StartupNotify=true
    
      77StartupWMClass=gigacode
    
      78DESKTOP
    
      79
    
      80  install -Dm644 "${pkgdir}/opt/gigacode/LICENSE.electron.txt" \
    
      81    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      82  install -Dm644 "${pkgdir}/opt/gigacode/LICENSES.chromium.html" \
    
      83    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      84}
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 11:27:14	Medium	3
2026-10-19 11:25:12	Medium	3